Privacy Policy

Zawiya ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights in relation to it. It applies to all users of the Zawiya platform — Photographers and their Clients.

1. Information We Collect

Account information. When you sign up we collect your name, email address, and a hashed password. Photographers may also provide a profile photo, bio, and website URL.

Payment information. We do not collect or process any payment-card or bank details, because there are no online payments on Zawiya. Paid plans and upgrades are arranged directly with our team over WhatsApp or email; in doing so we store only ordinary contact correspondence (such as your messages and the plan you asked us to activate), not financial account data.

Content you upload. Photographers upload photos and gallery metadata (titles, descriptions, settings). This content is stored on Cloudflare R2 infrastructure.

Client data. When a Client views a gallery, we may collect their email address if they provide it voluntarily (for example, to receive a gallery link).

Usage data. We automatically collect analytics events such as gallery views, page interactions, and feature usage. This data is associated with your account and used to improve the platform.

Technical data. We collect standard server logs including IP addresses, browser type, and referring URLs for security and debugging purposes.

2. How We Use Your Information

• Provide, operate, and improve the Zawiya platform.
• Respond to your enquiries and activate plans or upgrades you arrange with us.
• Send transactional emails (account confirmations, gallery share links, service notices).
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.
• Send product updates and announcements (you can opt out at any time).

3. Third-Party Services

We share data with the following trusted third parties to operate the service:

• Supabase — authentication and database hosting (EU region).
• Cloudflare R2 — image and video storage and delivery.
• Vercel— hosting and edge delivery of the web application. The application runs in Vercel's Frankfurt (fra1) region.
• Anthropic— the AI features described in section 9. When you use them, reduced-size copies of the relevant photographs are sent to Anthropic's API for processing.

We do not sell your personal data to third parties or use it for advertising purposes.

4. Cookies

We use essential cookies to manage your login session and keep you authenticated. We do not use third-party advertising or tracking cookies. You can disable cookies in your browser settings, but doing so will prevent you from logging in.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data and galleries are scheduled for deletion within 30 days. We may retain limited correspondence and records for as long as needed to provide the service and to comply with our legal obligations.

Galleries.A gallery has an expiry date that depends on the photographer's plan. After it expires it enters a recovery window, whose length is set per gallery, during which the photographer can restore it. After that it moves to cold archive. Photographs and their stored files are permanently purged 90 days after expiry at the earliest, and that purge is irreversible.

6. Your Rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (right to be forgotten).
• Export your data in a portable format.
• Object to certain types of processing.

To exercise any of these rights, contact us at info@zawiya.studio. We will respond within 30 days.

7. Data Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, row-level security in our database, and regular security reviews. However, no system is completely secure and we cannot guarantee absolute security.

8. Children's Privacy

Zawiya is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

9. AI Features and Your Photographs

Some features — automatic culling, natural-language search of a gallery, and story sections — are powered by an external AI model provided by Anthropic. When a photographer runs one of these, Zawiya sends a reduced-size copy of the relevant photographs to Anthropic's API so the model can look at them.

Only the small generated preview is ever sent — never your RAW file or the full-resolution original. AI features are opt-in per gallery: if a photographer does not use them, no photograph from that gallery is sent anywhere for AI processing.

Training.Zawiya does not use client photographs to train, fine-tune, or improve any model of our own, and we do not grant anyone else the right to do so. The same holds at our processor: Anthropic's Commercial Terms of Service state that "Anthropic may not train models on Customer Content from Services." You keep every right you have in the photographs you send, and in whatever the model returns about them.

How long the processor keeps them. Anthropic states that inputs and outputs submitted through its API are deleted within 30 days of being received or generated, apart from material it is required to keep longer for safety or legal reasons. That is separate from, and shorter than, how long the photographs live in your gallery on Zawiya — see section 5.

10. Facial Recognition and Biometric Data

Zawiya does not currently perform facial recognition, face grouping, or any other biometric identification, and does not create or store biometric templates or faceprints from your photographs.

Faces are of course visible in the photographs themselves, and the AI features in section 9 look at those images — but they return editorial judgements such as sharpness and composition, not identities. If we ever introduce face-based grouping we will update this policy, tell photographers before it is switched on, and make it something you opt into.

11. Subjects of Photographs, Including Minors

Zawiya is a tool photographers use; we have no relationship with the people in their photographs and no way to contact them. The photographer is the controller of that content, and is responsible for having whatever consent or model release the law of their jurisdiction requires — including, where the subjects are children, the consent of a parent or guardian, and including consent for the AI processing in section 9.

Section 8 concerns children using Zawiya themselves. This section concerns children who appear in photographs, which is a different question: we do not knowingly hold identifying information about them beyond the image itself. If you are a parent or guardian and want a photograph of your child removed, contact the photographer who took it; if you cannot reach them, write to us at info@zawiya.studio and we will help.

12. Gallery Links, Passwords and Access Codes

A gallery is one of four things: public, private, password-protected, or invite-only. A public gallery is intended to be found — it can appear on the photographer's profile and in search engines.

For every other kind, the link itself is the key. Anyone who has a gallery URL, its password, or an invite link can open it, so treat those the way you would treat a password: do not post them publicly, and do not forward them to people the photographer did not intend to include. We cannot tell whether a link was shared with your permission.

13. Where Your Data Is Processed

The application and database run in the European Union (Frankfurt). Photographs are stored on Cloudflare R2. When AI features are used, image previews are transmitted to Anthropic's API, which is operated from the United States — so using those features involves a transfer of that data outside the EU. That transfer is governed by Anthropic's Data Processing Addendum, which forms part of its Commercial Terms and incorporates the Standard Contractual Clauses (controller-to-processor and processor-to-processor modules), together with the UK and Swiss addenda.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or in-app notice. Continued use of Zawiya after changes constitutes acceptance.

15. Contact

Privacy questions or requests: info@zawiya.studio